diff --git a/selinux/flatpak.fc b/selinux/flatpak.fc index dc5b3bf8..fe6607ae 100644 --- a/selinux/flatpak.fc +++ b/selinux/flatpak.fc @@ -1 +1,3 @@ /usr/libexec/flatpak-system-helper -- gen_context(system_u:object_r:flatpak_helper_exec_t,s0) + +HOME_DIR/\.local/share/flatpak(/.*)? gen_context(system_u:object_r:flatpak_home_t,s0) diff --git a/selinux/flatpak.if b/selinux/flatpak.if index 3eb6a305..9a78388e 100644 --- a/selinux/flatpak.if +++ b/selinux/flatpak.if @@ -1 +1,21 @@ ## + +######################################### +## +## Transition to flatpak named content in user home +## +## +## +## Domain allowed access. +## +## +# +interface(`flatpak_named_filetrans_home_content',` + gen_require(` + type flatpak_home_t; + ') + + optional_policy(` + gnome_data_filetrans($1, flatpak_home_t, dir, "flatpak") + ') +') diff --git a/selinux/flatpak.te b/selinux/flatpak.te index bb3d80e3..618e600f 100644 --- a/selinux/flatpak.te +++ b/selinux/flatpak.te @@ -12,6 +12,9 @@ type flatpak_helper_t; type flatpak_helper_exec_t; init_daemon_domain(flatpak_helper_t, flatpak_helper_exec_t) +type flatpak_home_t; +userdom_user_home_content(flatpak_home_t) + auth_read_passwd(flatpak_helper_t) files_list_var_lib(flatpak_helper_t) files_read_var_lib_files(flatpak_helper_t)